🗃️

SolarWinds Security Incident

30/10/2023 693 days ago Resolved

Incident Overview

Situation Description

The SEC is increasing enforcement actions against CISOs, exemplified by charges filed against the former CISO of SolarWinds following a significant cyber breach.

Event Types

Data Breach Regulatory Enforcement

Industry Sector

Technology

Geographic Scope

nan

Response Actions

Pursued Litigation Paid Regulatory Fines or Legal Settlements

Impact Analysis

Event Types (2 identified)

Data Breach Regulatory Enforcement

Financial Impact

$26,000,000 USD

Records Affected

Data Types Compromised

Operational / System Data

Primary Impacts

Financial Loss Reputational Damage Legal/Regulatory Penalties

Key Decisions Made

The SEC filed charges against the former CISO of SolarWinds, Timothy G. Brown, alleging violations of securities laws and seeking penalties and an officer/director bar.; SolarWinds shareholders sued the company for securities fraud and settled for $26 million.; Companies should consider providing CISOs with personal indemnification agreements and ensuring they are covered by D&O insurance.

Technical Analysis

Attack Method

Unpatched Vulnerability

Vulnerability / Tool

SolarWinds Orion platform

Additional Information

Blog CISO Liability in Focus: SEC Enforcement, Insurance, and [Personal] Risk Mitigation Management Liability Priya Cherian Huskins, Esq. Nov 08, 2023 10 minutes The SEC is ratcheting up the pressure on CISOsand its entirely deliberate. The Securities and Exchange Commission (SEC) is ratcheting up the pressure on chief information security officers (CISOs)and its entirely deliberate. In this post, Ill discuss the litigation landscape against SolarWinds, the recent SEC charges filed against the SolarWinds CISO, and what companies can do to protect their CISOs. The SEC Is Done Fooling Aroundand Now Its Personal After years of relatively gentle guidance when it came to disclosing cyber risk and cyber breaches, the SEC signaled that the kid gloves had come off when it proposed and ultimately adopted its new cyber disclosure rules . The SEC had also already been signaling its changing enforcement posture, including a 2021 penalty of $500,000 it imposed on American Title Company and a $1 million penalty on Pearson plc for disclosure issues related to cyber events. After all of this, no one should be surprised that the SEC is now making enforcement personal. Its typical for the SEC to look for a particularly strong case to make its point. SolarWinds fits the bill. SolarWinds Shareholder Litigation By now, the facts of the SolarWinds situation are pretty familiar. As I noted in an earlier post on the SolarWinds cyber breach this year: As a brief recap, the Texas-based company develops software for businesses to manage their networks, systems, and IT infrastructure. Russian cyberterrorists successfully hacked into SolarWinds Orion platform and planted malicious code that was then deployed to all SolarWinds customers in a software update. That code installed a backdoor to each of those customers operating systems, which granted further access to cybercriminals to all of those companies. SolarWinds shareholders sued the company for securities fraud and settled for $26...

... (truncated for display)

Quick Facts

Company:: SolarWinds
Date:: 30/10/2023
Status:: Resolved
Decision Maker:: SEC
Position:: nan
Published:: 8/11/2023

Source Information

Original Query

Director and Officer (D&O) insurance premium trends after SEC cyber disclosure rules

View Original Source

Timeline

Information Published

8/11/2023

Incident Occurred

30/10/2023 (693 days ago)

Status: Resolved

Estimated resolution based on age

Actions

View Company Profile

Navigation

Quick Stats